Merge pull request #687 from DAN-MU-ZI/main

Issue #685 | Fix StringIndexOutOfBoundsException in ICC DESC tag processing
drewnoakes · Nov 26, 2024 · 3db5330 · 3db5330
2 parents 0c3452b + da59f94
commit 3db5330
Showing 1 changed file with 6 additions and 0 deletions.
diff --git a/Source/com/drew/metadata/icc/IccDescriptor.java b/Source/com/drew/metadata/icc/IccDescriptor.java
@@ -21,6 +21,7 @@
 
 package com.drew.metadata.icc;
 
+import com.drew.lang.BufferBoundsException;
 import com.drew.lang.ByteArrayReader;
 import com.drew.lang.RandomAccessReader;
 import com.drew.lang.annotations.NotNull;
@@ -91,6 +92,11 @@ private String getTagDataString(int tagType)
                     }
                 case ICC_TAG_TYPE_DESC:
                     int stringLength = reader.getInt32(8);
+
+                    if (stringLength < 0 || stringLength > (bytes.length - 12)) {
+                        throw new BufferBoundsException(12, stringLength, bytes.length);
+                    }
+
                     return new String(bytes, 12, stringLength - 1);
                 case ICC_TAG_TYPE_SIG:
                     return IccReader.getStringFromInt32(reader.getInt32(8));